CVE-2020-1227: 
vulnerability analysis and mitigation

A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize specially crafted web requests to affected SharePoint servers. This vulnerability was disclosed and patched in September 2020 (NVD, Microsoft Support).

The vulnerability affects Microsoft SharePoint Server installations and occurs due to improper sanitization of web requests. The issue was addressed in the September 8, 2020 security updates for multiple SharePoint versions including SharePoint Server 2019, SharePoint Server 2016, and SharePoint Server 2013 SP1 (Microsoft Support).

If successfully exploited, this cross-site scripting vulnerability could allow an attacker to execute malicious scripts in the context of the user's session. This could enable the attacker to read content that the user has access to, use the user's privileges to perform actions on the SharePoint site, and inject malicious content into the user's browser (NVD).

Microsoft has released security updates to address this vulnerability. The fixes are available through various methods: Microsoft Update, Microsoft Update Catalog, and Microsoft Download Center. For SharePoint Server 2019, install security update KB4484505; for SharePoint Server 2016, install KB4484506; and for SharePoint Server 2013 SP1, install KB4484515 (Microsoft Support).